In one conventional arrangement, an enterprise network may include a first network node that is coupled to a second network node. The second network node may couple the enterprise network to an external network that includes a third network node. The second network node may provide security features for the enterprise network that involve inspection and/or analysis of packets passing from the enterprise network to the external network, and vice versa.
In this conventional network arrangement, the first network node and the third network node may exchange encrypted communications with each other. These communications may be carried out based upon cryptographic keys that are exchanged by the first network node and the third network node, but are not disclosed to the second network node. This may prevent the second network node from being able to perform meaningful inspection of and/or analysis of the contents of the encrypted communications between the first network node and the third network node. Disadvantageously, this may compromise the enterprise network's security, and may otherwise deleteriously effect the enterprise network (e.g., by permitting introduction of viruses, etc. to the enterprise network).
Furthermore, a relatively large number of secure connections may traverse the second network node. In this conventional arrangement, in order to perform such meaningful inspection and/or other analysis, the second network node associates each of these connections with its respective cryptographic keys and/or other information. This may pose a significant connection scalability issue in this conventional arrangement that may significantly reduce both the number of connections that may be processed and the speed with which such processing may be carried out in this conventional arrangement. Additionally, in this conventional arrangement, the number and characteristics of these secure connections may not be static over time, and in fact, may drastically change over relatively short time intervals. Given these dynamically changing connections, in order to be able to perform such meaningful inspection and/or other analysis, a significant amount of connection synchronization processing overhead may be imposed on the second network node.
Also, in this conventional arrangement, each respective secure connection between the first and third nodes may involve a respective secure connection between the second and third nodes. For each respective secure connection between the second and third network nodes, the second network node may negotiate a respective cryptographic key with third network node that may be used to establish the respective secure connection. Given the relatively large number of connections that may exist in this conventional arrangement, undesirably large numbers of key negotiations and associated handshakes may occur, and an undesirably large number of keys may be negotiated between the second and third nodes. Additionally, undesirably large amounts of key storage and processing may be involved in this conventional arrangement.
Although the following Detailed Description will proceed with reference being made to illustrative embodiments, many alternatives, modifications, and variations thereof will be apparent to those skilled in the art. Accordingly, it is intended that the claimed subject matter be viewed broadly.